Summaryinfo

A vulnerability was found in Microsoft Windows XP/Vista/7/8/8.1. It has been classified as problematic. This issue affects the function win32k!xxxMenuWindowProc in the library win32k.sys. Performing a manipulation results in denial of service. Attacking locally is a requirement. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Microsoft Windows XP/Vista/7/8/8.1 (Operating System). It has been classified as problematic. This affects the function win32k!xxxMenuWindowProc in the library win32k.sys. The manipulation with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability.

The weakness was published 11/22/2014 by Kedamsky as EDB-ID 35326 as not defined exploit (Exploit-DB). The advisory is shared at exploit-db.com. The public release happened without involvement of Microsoft. The exploitability is told to be easy. An attack has to be approached locally. The requirement for exploitation is a authentication. Technical details and a public exploit are known. The reason for this vulnerability is this part of code:

8f584e72 85c0 test eax,eax
8f584e74 0f84f7040000 je win32k!xxxMenuWindowProc+0xf00 (8f585371)
8f584e7a 8b00 mov eax,dword ptr [eax] ; <-- eax = -1
...
8f584fa9 e8b2320000 call win32k!xxxMNOpenHierarchy (8f588260)
8f584fae e9bffeffff jmp win32k!xxxMenuWindowProc+0xa01 (8f584e72)

The vulnerability exists in the function win32k!xxxMenuWindowProc. It calls the function win32k!xxxMNOpenHierarchy that can return valid pointer to data and 0 or -1 otherwise. The function win32k!xxxMenuWindowProc does not validate the result of win32k!xxxMNOpenHierarchy properly and it is possible to try to read data from address -1.

A public exploit has been developed by Kedamsky in C and been published immediately after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the databases at X-Force (99087), Exploit-DB (35326) and OSVDB (115522†). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 7
• 8
• 8.1
• Vista
• XP

License

• commercial

Support

• end of life (old version)

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion